-
-
Notifications
You must be signed in to change notification settings - Fork 100
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adds components.properties filtering in bom #373
base: master
Are you sure you want to change the base?
Conversation
Signed-off-by: Tim Messing <[email protected]>
Signed-off-by: Tim Messing <[email protected]>
Signed-off-by: Tim Messing <[email protected]>
depscan/cli.py
Outdated
bom_data["vulnerabilities"] = pkg_vulnerabilities | ||
json_dump(vdr_file, bom_data, error_msg=f"Unable to generate VDR file at {vdr_file}", log=LOG) | ||
|
||
|
||
def remove_extra_properties(bom_data): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@timmyteo Could we refactor this to simplify?
exclude_properties = {"Namespaces", "ImportedModules"}
for i, component in enumerate(bom_data["components"]):
if properties := component.get("properties"):
bom_data["components"][i]["properties"] = [p for p in properties if p.get("name") not in exclude_properties]
return bom_data
@prabhu Do we want to make the excluded or allowed properties an optional argument for this function?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Optional argument sounds good. Support for regex or startswith since blint uses "internal:" prefix
Signed-off-by: Tim Messing <[email protected]>
@prabhu - I have added regular expression matching for exclusion and made the feature controlled by an optional argument to the command line. @cerrussell - Thanks for the simplified code! If you see a way of further simplifying the new logic added for the regular expression matching, please let me know. |
@timmyteo Thank you for the improvements. I am not convinced about a cli argument specifically for this. Perhaps, this could be part of some profile with some trimming happening by default. Let me include these changes in a new PR, since I am also planning to do some refactoring. |
Implements #362
Filters the desired components.properties objects by name. This implementation uses an exclude list instead of an allow list. Filtering is applied to the file
sbom-universal.vdr.json
Attached are before and after bom files to demonstrate filtering in action on an example. In this example, the bom only had the property "ImportedModules"
after.json
before.json